# Facebook CSRF leading to full account takeover

Facebook contact-importer login endpoint lacked CSRF protection, letting an attacker silently bind their own email to a victim's account and reset the password for full takeover.

- Payout: unconfirmed
- Severity: high
- Program: Meta / Facebook
- Credited: Josip Franjkovic
- Disclosed: 2013-10-18
- Write-up quality: 6/10
- Original: https://www.josipfranjkovic.com/blog/facebook-csrf-full-account-takeover
- Library page: https://bugbountylibrary.com/r/blog%3Ajosipfranjkovic-com-blog-facebook-csrf-full-account-takeover
- Tags: domain:web impact:ato kind:bounty platform:blog sev:high tech:oauth technique:recon vuln:account-takeover vuln:csrf

**Target:** Facebook contact-importer login endpoint (m.facebook.com/contact-importer/login)
**Root cause:** The contact-importer login GET request that binds an email to the logged-in account performed no CSRF/ownership checks and could be replayed for any user, so a forged request added the attacker's email to the victim's account.
**Steps:**
1. From attacker account use 'Find contacts on Facebook' and log all requests
2. Identify the `GET https://m.facebook.com/contact-importer/login/?api_instance=1&api_ver=wave5&auth_token=TOKEN` request
3. Remove the added email from the attacker account
4. Get the victim to trigger that same request (e.g. via CSRF)
5. Email is now silently added to victim's account
6. Use 'Forgot your password' with that email to take over the account
**How found:** Attacker logged all requests while using 'Find contacts on Facebook' and noticed the /contact-importer/login request had no checks and could be repeated; testing showed it worked for other users too.
**Exploitation:** Attacker with an Outlook.com email not bound to their Facebook account obtains the contact-importer login URL, removes the email from their own account, then induces the victim to load the request, binding the attacker's email to the victim's account; password reset via that email yields full account takeover.
**Insight:** OAuth/contact-importer callback-style GET endpoints that bind an identity (email) to the session often skip CSRF and ownership checks; replaying the captured importer request against another user's session silently attaches attacker-controlled identifiers.